Aw: Re: Re: Re: Re: Re: Re: Re: Flowtable with ppp/bridge

[Frank Wunderlich <frank-w@public-files.de>]

regards Frank


> Gesendet: Montag, 10. Mai 2021 um 10:24 Uhr
> Von: "Pablo Neira Ayuso" <pablo@netfilter.org>
> An: "Frank Wunderlich" <frank-w@public-files.de>
> Cc: netfilter@vger.kernel.org
> Betreff: Re: Re: Re: Re: Re: Re: Re: Flowtable with ppp/bridge
>
> On Mon, May 10, 2021 at 08:50:56AM +0200, Frank Wunderlich wrote:

> > > Gesendet: Donnerstag, 06. Mai 2021 um 17:51 Uhr
> > > Von: "Pablo Neira Ayuso" <pablo@netfilter.org>
> >
> > > > >    chain FORWARD {
> > > > >         type filter hook forward priority 0; policy drop;
> > > > >
> > > > >         tcp flags syn tcp option maxseg size set rt mtu
> > > > >         ct state vmap { established : jump FORWARD_established, related : jump FORWARD_established, new : jump FORWARD_new }
> >
> > tried this way, seems to work so far, i have only problem on removing my ruleset with iptables (have this to reset my complete firewall, not only nft).
> >
> > iptables -X
> > iptables v1.8.2 (nf_tables):  CHAIN_USER_DEL failed (Device or resource busy): chain FORWARD_known
> >
> > i guess iptables cannot delete chain cause it is linked by ctstate vmap any idea?
>
> In iptables, you have to flush a chain (-F) before you can delete it.

i do this:

+ iptables -F
+ iptables -X
iptables v1.8.2 (nf_tables):  CHAIN_USER_DEL failed (Device or resource busy): chain FORWARD_known
+ iptables -t nat -F
+ iptables -t nat -X
+ iptables -t mangle -F
+ iptables -t mangle -X
+ iptables -P INPUT ACCEPT
+ iptables -P OUTPUT ACCEPT
+ iptables -P FORWARD ACCEPT

and

+ iptables-legacy -F
+ iptables-legacy -X
+ iptables-legacy -t nat -F
+ iptables-legacy -t nat -X
+ iptables-legacy -t mangle -F
+ iptables-legacy -t mangle -X
+ iptables-legacy -P INPUT ACCEPT
+ iptables-legacy -P OUTPUT ACCEPT
+ iptables-legacy -P FORWARD ACCEPT

same for ipv6 and then import my ruleset which contains the "flush ruleset" on top (after defines)

nft -f /usr/local/sbin/firewall/ruleset_new_v4+v6.nft

> Anyway, once you step in to use nftables, it is better if you use
> native nftables commands to operate, such as:

>  nft flush ruleset

i do this too, but running iptables before to make sure no legacy firewall is defined which may block (to be able to switch to my old firewall script for testing and back)

> > is order important of defined chains? maybe i can move the 2 new
> > forward-chains below old with "ct state vmap"
>
> Not sure what you mean, could you provide an example?

currently i have defined new forwarding chains first and then use them

table ip filter {
    flowtable f {
        hook ingress priority 10
        devices = { wan, lan0, lan1, lan2, lan3 }
        flags offload
    }

    chain FORWARD_known {
        ip protocol { tcp, udp } flow add @f
        accept
    }

    chain FORWARD_new {
        #rules for new forward connections
    }

    chain FORWARD {
        type filter hook forward priority 0; policy drop;
        oifname $ifexternal tcp flags syn tcp option maxseg size set 1452
        ct state vmap { established : jump FORWARD_known, related : jump FORWARD_known, new : jump FORWARD_new }
        counter jump REJECTED
    }

    chain REJECTED {
        #limit rate 10/minute counter packets 0 bytes 0 log prefix "NETFILTER4-REJECTED: " level debug
        ip protocol tcp reject with tcp reset comment "Drop with tcp-reset"
        ip protocol udp reject comment "drop and count packets"
        counter drop
    }
}

i see that i have rejected also used before defining it...so maybe it works with the forwarding-chains too. basicly putting FORWARD_known and FORWARD_new below FORWARD.

regards Frank